---
title: "Creates a new API key for the tenant.
IMPORTANT: The full API key is only returned once during creation.
Store it securely - you cannot retrieve it again."
method: POST
path: "/api/tenants/{tenantId}/api-keys"
tags: ["ApiKeys"]
---

# Creates a new API key for the tenant.
IMPORTANT: The full API key is only returned once during creation.
Store it securely - you cannot retrieve it again.

`POST /api/tenants/{tenantId}/api-keys`

## Path parameters

- `tenantId` string, required

## Request body

- CreateApiKeyRequestDto — Request DTO for creating an API key. TenantId is taken from the route parameter.
  - `name` string, required — Human-readable name for the API key.
  - `description` string, nullable — Optional description of what this key is used for.
  - `scopes` string[], nullable — Scopes to grant. Defaults to ["read", "write"] if not specified.
  - `expiresAt` string, date-time, nullable — Optional expiration date.
  - `allowedIpAddresses` string[], nullable — Optional IP allowlist. If set, only requests from these IPs are allowed.
  - `metadata` object, nullable — Additional metadata.

## Response `201`

Created

- CreateApiKeyResponse
  - `apiKey` string, required
  - `keyHash` string, required
  - `keyPrefix` string, required
  - `tenantId` string, required
  - `name` string, required
  - `scopes` string[], required
  - `createdAt` string, date-time, required

## Other responses

- `400` — Bad Request

---

[API](https://skmtc.net/clinicos/apis/pawthosx-business-api-v1.md) · [All operations](https://skmtc.net/clinicos/apis/pawthosx-business-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/clinicos/pawthosx-business-api-v1/revisions/a905bde4e796/schema)